services.bulwark.settings.oauth.allowPrivateEndpoints
NixOS option
Allow OAuth discovery to resolve to private (RFC-1918 / loopback) addresses. Off by default as an SSRF guard. Enable for split-DNS deployments where the OAuth issuer’s public hostname resolves to an internal IP from this server.
type: booleanDefault
declared in: nixos/modules/services/web-apps/bulwark.nixView source on NixOS/nixpkgs →false